Bump io.netty:netty-bom from 4.2.12.Final to 4.2.14.Final

[dependabot]

Bumps io.netty:netty-bom from 4.2.12.Final to 4.2.14.Final.

Release notes

Sourced from io.netty:netty-bom's releases.

netty-4.2.14.Final

What's Changed

• HTTP: Fix revapi failure introduced by 84530fa81e12dcd1d42310bb20c1385cb44128d8 by @​normanmaurer in netty/netty#16748
• HTTP: Re-add constructor to HttpProxyHandler that was removed by mistake by @​normanmaurer in netty/netty#16747
• Marshalling: Explicit document security requirements by @​normanmaurer in netty/netty#16752
• Fix io_uring op completion TRACE logging by @​chrisvest in netty/netty#16755
• Quic: Ensure writes are done before notify close promise of QuicheQui… by @​normanmaurer in netty/netty#16758
• Avoid re-parsing openssl key material with non-cached provider by @​chrisvest in netty/netty#16759
• Pin HTTP/RTSP version + method normalization to Locale.US by @​daguimu in netty/netty#16765
• Fill MsgHdrMemoryArray#hdrs with null entry on release by @​tsegismont in netty/netty#16764
• Revapi: Use default "oldVersion" by @​chrisvest in netty/netty#16774
• Adaptive: Fix concurrency issue in adaptive allocator by @​chrisvest in netty/netty#16767
• Auto-port 4.2: Make bulk byte moving in ByteBuf faster by @​netty-project-bot in netty/netty#16781
• Pin multipart Content-Type / Content-Transfer-Encoding case folding to Locale.US by @​daguimu in netty/netty#16768
• Remove dead native declarations by @​pandareen in netty/netty#16783
• Isolate tests that modify available Security providers by @​chrisvest in netty/netty#16793
• Remove test annotations from a method that isn't a test by @​chrisvest in netty/netty#16792
• Enable OpenSslCachingKeyMaterialProvider to evict stale entries after cert rotation by @​zhangweikop in netty/netty#16523
• IoUring: extend user data from short to long by @​dreamlike-ocean in netty/netty#16682
• Revert CompositeByteBuf component search fast path by @​yawkat in netty/netty#16811
• HTTP2: Use 100 as default max concurrent streams setting by @​normanmaurer in netty/netty#16804
• Fix ResumptionController wrapping by @​chrisvest in netty/netty#16815
• Resolve all localhost addresses without querying DNS servers by @​JulianVennen in netty/netty#16749
• IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules are configured but remote peer is using ipv4 by @​normanmaurer in netty/netty#16803
• Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe by @​dreamlike-ocean in netty/netty#16788
• Route synchronous onLookupComplete exceptions via fireExceptionCaught by @​kwondh5217 in netty/netty#16794
• IoUring: Stop generic FileRegion drain loop when transferred() reaches count() by @​LuciferYang in netty/netty#16826
• MQTT: Allow MQTT 5 CONNECT with password only by @​shblue21 in netty/netty#16833
• Fix MQTT decoder size check after variable header replay by @​daguimu in netty/netty#16787

New Contributors

• @​pandareen made their first contribution in netty/netty#16783
• @​zhangweikop made their first contribution in netty/netty#16523
• @​JulianVennen made their first contribution in netty/netty#16749
• @​kwondh5217 made their first contribution in netty/netty#16794
• @​shblue21 made their first contribution in netty/netty#16833

Full Changelog: netty/netty@netty-4.2.13.Final...netty-4.2.14.Final

netty-4.2.13.Final

CVEs Fixed

• CVE-2026-42586 (netty-codec-redis)
• CVE-2026-42578 (netty-handler-proxy)
• CVE-2026-42577 (netty-transport-native-epoll)
• CVE-2026-42587 (netty-codec-http, netty-codec-http2)
• CVE-2026-41417 (netty-codec-http)
• CVE-2026-42581 (netty-codec-http)
• CVE-2026-42580 (netty-codec-http)
• CVE-2026-42585 (netty-codec-http)
• CVE-2026-42579 (netty-codec-dns)

... (truncated)

Commits

• 0a60b75 [maven-release-plugin] prepare release netty-4.2.14.Final
• 72df658 Fix MQTT decoder size check after variable header replay (#16787)
• 7125dba MQTT: Allow MQTT 5 CONNECT with password only (#16833)
• 9e19320 IoUring: Stop generic FileRegion drain loop when transferred() reaches count(...
• 4ce9f17 Route synchronous onLookupComplete exceptions via fireExceptionCaught (#16794)
• f7b1b7d Fix memoryAddress() for direct ByteBuffers wrapped by Unpooled without Unsafe...
• 0ccb265 IpFilter: Fix ClassCastException caused by IpSubnetFilter if only ipv6 rules ...
• a6aeb6d Resolve all localhost addresses without querying DNS servers (#16749)
• c328ba2 Fix ResumptionController wrapping (#16815)
• bc5862b HTTP2: Use 100 as default max concurrent streams setting (#16804)
• Additional commits viewable in compare view

[xiang17]

@dependabot recreate

[rajkumar-rangaraj]

@dependabot recreate